Fly.io

Fly.io connects with an API token from your dashboard. Use the most restrictive token type: Praxen Inc. only needs read access. Your token is encrypted before it is stored, and the agent never sees it.

Setup

1. Open the Fly.io Dashboard and go to Tokens.
2. Create a new read-only token.
3. Copy the token and paste it into Praxen Inc.
4. Praxen Inc. validates the token and starts syncing.

Praxen Inc. discovers your apps, machines, volumes, certificates, and other Fly.io resources.

Token types

Disconnecting

Disconnect the account in Praxen Inc., then revoke the token from your Fly.io dashboard under Tokens.

Connecting Fly.io needs no browser: the same endpoint the console calls fits in a CI job. One authenticated POST creates the connection and starts the first sync.

Prerequisites

• A Praxen Inc. API key with the cloud_accounts:write and cloud_accounts:read scopes. See API keys and OAuth.
• Your workspace ID, which starts with ws_. Read it from GET /v1/workspaces with the same key.
• A Fly.io read-only API token, created under Tokens in the Fly.io dashboard.

Create the connection

curl -X POST https://api.getpraxen.app/v1/cloud_accounts \
  -H "x-api-key: $PRAXEN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "fly",
    "workspaceId": "ws_0abc123",
    "token": "<fly-api-token>"
  }'

The token resolves to one Fly.io organization, so one call connects one organization.

• Organization discovery reads the apps the token can see, so a token that reaches no apps fails with a 400.

The response lists what was connected, with the first sync already running. Trimmed to the two fields the rest of the flow reads:

{
  "success": true,
  "result": {
    "provider": "fly",
    "accounts": [{ "id": "acc_34gky74ibc92h8t2efn8csrh", "status": "syncing" }],
    "failures": []
  }
}

An account that is already connected lands in failures instead of accounts, so repeating the call never duplicates a connection.

Wait for the first sync

Poll each returned account by its id until status reaches ready (new on registration, syncing while resources stream in):

until [ "$(curl -s "https://api.getpraxen.app/v1/cloud_accounts/$WORKSPACE_ID/$ACCOUNT_ID" \
  -H "x-api-key: $PRAXEN_API_KEY" | jq -r '.result.status')" = "ready" ]; do
  sleep 15
done

Give the loop a deadline so a failed connect fails the job instead of hanging it. Once the account is ready, its resources are in the topology and Praxen Inc. has started its first check.

Disconnect from the API

Deleting the connection stops every sync and check and deletes the credentials Praxen Inc. held. The call needs the cloud_accounts:delete scope:

curl -X DELETE "https://api.getpraxen.app/v1/cloud_accounts/$WORKSPACE_ID/$ACCOUNT_ID" \
  -H "x-api-key: $PRAXEN_API_KEY"

Then revoke the Fly.io credential on the provider side, as described under Disconnect below.